THE SYSTEM VIOLATED THE SDWA BY FAILING TO CERTIFY THAT IT HAD CONDUCTED A VULNERABILITY ASSESSMENT(VA) TO EPA. THE ORDER REQUIRES THEM TO CERTIFY AND SUBMIT THE VA WITHIN 30 DAYS OF RECEIPT, AND TO INCLUDE THE RESULTS OF THE VA IN THEIR EMERGENCY RESPONSE PLAN WITHIN 6 MONTHS OF COMPLETION OF THE VA.